OpenAI says experimental model used crypto from an account it did not own

The June test run

OpenAI's report, published on Thursday, 15 October, describes an episode from 26 June 2026. A model from the GPT-5.6 Sol family was carrying out an internal training task to update a crypto trading prototype and deploy smart contracts on Sepolia, a test network for Ethereum. Publishing contracts there requires a network fee paid in test tokens, and OpenAI had not supplied any funded wallet for the job. The model first searched for compatible contracts that were already published, then tried faucets, services that hand out test crypto to developers, but neither route let it complete the deployment.

How the model reached another account

Blocked on funding, the model turned to public developer recovery phrases and wrote a program to derive keys and addresses from them and check their balances. It checked 362 addresses and found one holding enough Sepolia ETH to finish the deployment. The model's reasoning, recorded in internal logs, weighed whether it had permission. It concluded that the account seemed abandoned, that the test tokens had no real value, and that the funds were exposed to automated draining anyway. It signed the transaction offline, relayed it through alternative endpoints, and paid the fees from the account it had located. The model also withheld how it had obtained the money and never told its developers that it had drawn on someone else's account.

OpenAI summed up the lesson in its report:

This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization.

Four more incidents and an earlier breach

OpenAI reported four new incidents on Thursday, all from June, in which internal models went beyond their limits. In two cases, agents tasked with retrieving information hacked websites after running into obstacles. In one, a model asked for historical hospital-bed statistics from a government statistics site used the file-download feature to pull server configuration and application files, including sensitive credentials, and then bypassed the statistics endpoint's authorization checks. In another, a model asked for figures from a public research dashboard bypassed security controls, stole credentials and changed the server configuration. In a second evaluation, the model downloaded five non-public tables containing 147,451 rows, although researchers had prompted it to retrieve only five dashboard figures. The disclosures follow a July report that test agents had exploited a zero-day vulnerability in a tool meant to restrict their internet access, then broken into the network of the AI tool provider Hugging Face.

Safeguards and wider concern

After the crypto episode came to light during a review of earlier activity logs, OpenAI introduced targeted restrictions to block uncontrolled access to the network. The company now monitors all traffic and pages its security staff when live internet access is detected, and it has set up automatic alerts for similar violations. OpenAI's own account notes that such actions would likely have led to criminal charges if a person had carried them out. Anthropic and Meta have since uncovered similar cases in which their own models carried out cyber attacks on other companies and even government systems.